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REMARKS 

Amendments have teen made to the Title and specification. Claims 1 , 6, 13, 18, 25, 30, 
39, 44, and 47 have been amended. No new matter has been introduced with these amendments, 
all of which are supported in the specification as originally filed. Claims 3 - 5, 15 - 1 7, 27 - 29, 
and 41 - 43 have been cancelled from the application herein without prejudice. Claims 1 - 2, 6 - 
7 s 9 - i4 9 ig . 19, 21 - 26, 30 - 32, 34 - 37, 39 - 40, 44 - 45, and 47 remain in the application. 

I. Objection tq the Title 

Paragraph 2 of the Office Action dated March 4, 2005 (hereinafter, 'Hhe Office Action") 
states that the Title is objected to as not being descriptive. The Examiner suggests prepending 
"Method, System, and Computer Program Product" to the current Title. The MPEP states, in 
§606.1 1, "Examiner May Require Change in Title 5 ', that 'This (changing the title] may result in 
slightly longer titles, but the loss in brevity of title will be more than offset by the gain in its 
informative value jn indexing, classifying, searching, etc.". Applicant respectfully submits that 
adding the suggested terms to the current Title will m no way provide a "gain in ... informative 
value [for] indexing, classifying, [or] searching". However, to avoid further delay in passing the 
application to issuance, Applicant has amended the Title as per the Examiner's suggestion, and 
the Examiner is therefore respectfully requested to withdraw this objection. 

II, Objection to the Claims 

Paragraph 9 of the Office Action states that Claims 5 - 6, 17 - 18, and 29 - 30 are objected 
to because of their numbering. In view of the amendments and cancellations made herein, this 
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objection is rendered moot, and the Examiner is therefore respectfully requested to withdraw the 
objection. 

m. Re jectio ntm4ey 35U.g.C,§102fb) 

Paragraph 12 of the Office Action states that Claims 13 - 19, 21 - 22, 24 - 33, 34 - 35, 37, 
39 - 45, and 47 are rejected under 35 U-S.C. § 102(b) as being anticipated by Patel ct al ("An 
Efficient Discrete Log Pseudo Random Generator"). Claims 15 - 17, 27 - 29, and 41 - 43 have 
been cancelled from the application without prejudice, rendering the rejection moot as to those 
claims. This rejection is respectfully traversed with regard to the remaining claims. 

Applicant's independent Claims 13, 25, and 39 (as well as Claim 1, which is rejected 
under 35 U.S-C §103 and discussed below) have been amended herein to incorporate limitations 
from now-cancelled dependent claims, by way of clarification. Applicant's independent claims 
explicitly specify that the C-bit input value is provided "as an exponent of '(emphasis added) the 
1-way function. (See Claim 1, lines 6 - 8, referring to "a length in bits, C, of the input value" and 
"using the provided input value as an exponent of a 1 -way function".) These independent claims 
further specify that the "base of the modular exponentiation is a fixed generator value" (see 
Claim 1, line 9). 

With reference to Claim 16, which previously contained the limitation pertaining to use 
of the input value as an exponent, the Office Action cites Patel, page 313, section 5, line 10. 
However, what is stated therein is use of an exponent x t and using, as output of an step, a 
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subset of the bits of In particular, Patel states that the lower n - 6)(log n) bits of x t are used as 
output (while the size of Patel's exponent is n bits). By contrast, Applicant's claimed invention 
uses a Obit exponent. 

In the Advisory Action dated May 27, 2005 (hereinafter, et the Advisory Action"), the 
Examiner states that Patel uses a "C-bit exponent. Applicant respectfully disagrees- When 
discussing this point, the Advisory Action refers to the above-discussed text on page 313, section 
5, line 10 of Patel. This text of Patel will now be discussed in more detail. What is taught 
therein is that Patel uses an exponent and that some "lower" bits are output from the 
generator function at the /th iteration (when i > 0). The number of these lower bits is stated as 
"the lower n - O)(log n) bits of x„ except the least significant bit", provided i > 0. 

However, the number of bits that are output from the generator and the number of bits in 
the jesnJt of the generator are not the same. (If these numbers were the same, then all bits in the 
result would be output and the phrase **the lower ... bits would have no meaning.) The 
number of bite in the result_of the generator is referred to by Patel as n (Abstract, line 1 3), and the 
number of bits output per iteration is referred to as n - c (Abstract lines 11-13). Patel also uses 
the expression "n - G)(log «)" when describing the number of output bits. See page 313, 
penultimate line. (That is, "<D(log »)" is also called V\) 

Patel states, by way of example, that n may be 1024 while c may be 128 (Abstract, Hnes 
13 - 14). In other words, the generator result %/' at each iteration may be 1 024 bits in length, 
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while "a little less than 900" of those bits are output from the iteration (Abstract, line 14). 

Consider the expression of Pstel's "new generator" for several example values of i, using 
the algorithm provided on page 313, last paragraph (that is, x&+l) = g* (Q mod;?), as follows: 
x(0) = a seed picked from Z p * 

x(l) = mod p -2 = 0, therefore no output 

x(2) = g* 0 mod p - i « 1 , output lower (n - c) bits of x(l) 

x(3) = mod p -2 = 2, output lower (n - c) bits of x(2) 

x(4) ~ g* (S) mod p - i = 3, output lower (n ~ c) bits of x(3) 

x(5) = g* (4) mod p - / = 4, output lower (n - c) bits of x(4) 

x(6) - g* w mod p -f = 5, output lower (n - c) bits of x(5) 

It may be that Palel actually meant "... when (i + I) > 0 S output the lower ... bits of x(l + 
IJ 9 — because otherwise, Patel is outputting bits from the exponent rather than bits of the 
result of the generator. Accordingly, the example expressions may be rewritten as follows: 
x(0) = a seed picked from Z,* - i + 1 = 0, therefore no output 
x (I) = mod p - / = 0, output lower (n - c) bits of x(J) 

x(2) = g*° mod p -/= 1, output lower (n - c) bits of x(2) 

x(3) = mod p ~ / = 2, output lower (n - c) bits of x(3) 

x(4) « g 1 ^ mod -J = 3, output lower (n - c) bits of x(4) 
x(5) = g# 4 > mod /? - i = 4, output lower (n - c) bits of x(5) 

x(6) - g* rJ; mod p —i-S f output lower (n - c) bits of x(6) 
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At any rate, what can be seen by these example expressions for several iterations of 
Palel's generator is that the exponent being used in each iterati on is specified as the entire output 
of the prior iteration . For example, when z = 2 in the second set of expressions provided above, 
Patel teaches that "a little less than 900 bits" of x(3), or "the lower n - to(log ri) bits" of x(3)> are 
output from the generator. However, the algorithm does ngt state that only "6)(log ri) bits" (i-e^ 
"c" bits) ofx(3) are vised as the exponent when computing x(4) . Instead, the algoritibm specifies 
that the exponent used when computing x(4) is x(3) — and as noted above, the length ofx(3) is n 
bits. This is distinct from Applicant's claimed invention. 

The Advisory Action refers to page 3 14, section 5.1 of Patel as teaching that the "input 
exponent when using short exponents was Q(log ri) bits, or "C" bits" Applicant respectfully 
disagrees: section 5. 1 does no£ specify Patel' s algorithm. The algorithm was specified in section 
5 on page 3 13, which has been discussed above. Section 5. 1 , on the other band, is a "proof of 
security" of PatePs algorithm. In this proof of security* Patel uses a different value "g 9 mod/?" 
(that is, g ** s), where the exponent s has C0(log ri) bits. In the second paragraph, last sentence, 
of section 5*1, Patel again states that it is s — that is, the exponent used in the algorithm for 
proving the security of the generator - that has length o>(log ri) bits, referring to this length as a 
"short exponent". However, the length of th e exponent used in the proof of security is not the 
length of the exponent used in PatePs generator . 

It should also be noted that Patel explicitly refers to the size of his generator's exponents 
as "large". See section 7.1, "Improving Efficiency of Computations", in PatePs Appendix. In 
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line 3 of the first paragraph, Patel again presents his generator algorithm using the entire output 
of a prior iteration as the exponent in each next iteration, and in lines 3 - 4, refers to the output 
bite of the generator's iterations. In the next paragraph, lines 1- 2, Patel states "Although the 
number of bits generated per iteration [of the generator] is large, each iteration involves a large 
exponent and this could impact on the speed of the generator" (emphasis added). This use of 
Jarge exponents is distinct from Applicant's claimed invention. 

Patel continues, in this second paragraph of section 7.1, by noting a possibl e alternative 
approach where the length of the exponent for the generator could be shortened to s(i) 9 where s(i) 
is the "leading O)0og n) bits of [the generator's result] x(i/\ and then stating that this approach 
"will ensure that at each stage we aw using short exponents However, Patel continues by 
stating that this alternative approach ''raises some interesting questions", and — as the answer to 
Question 1 0, which asks whether using short exponents will impact the security of the generator 
~ states that "when we restrict our exponents [to the "short" exponents comprising <0(log n) bits 
of the generator's output] we no longer have a permutation ... [and therefore] the simple 
construction used here [i.e., the simple algorithm that can output nearly 900 bits per iteration] is 
inapplicable" (emphasis added). See page 316, section 7.1 , paragraph 2, last sentence and 
paragraph 3 ? lines 1-2. 

Accordingly, this text on page 316 teaches away from using only C bits of the generator's 
output as the exponent of the next iteration. 
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Because Patel' s generator function uses n-bit exponents, stating that these are "large" 
exponents, and in his alternative approach, Patel teaches away from using the C-bit 
("substantially shorter") exponents of Applicant's claimed invention, Applicant respectftilly 
submits that his independent Claims 1* 13, 25, and 39 are patentable over the teachings of Patel. 
Dependent Claims 14, 18 - 19, 21 - 22, 24, 26, 30 - 33, 34 - 35, 37, 40, 44 - 45, and 47 ate 
therefore deemed patentable over the reference as well. The Examiner is therefore respectfully 
requested to withdraw the §102 rejection. 

rv. Rejection Under 35 U.S.C, S103fa> 

Paragraph 30 of the Office Action states that Claims 23 and 36 are rejected under 35 
U.S,C §103(a) as being unpatentable over Patel in view of Schneier (" Applied Cryptography"). 
Paragraph 31 - 32 of the Office Action state that Claims 1 - 7 and 9 - 12, respectively, are also 
rejected using these references. Claims 3 - 5 have been cancelled from the application without 
prejudice, rendering the rejection moot as to those claims. These rejections are respectfully 
traversed with respect to the remaining claims. 

Applicant's independent Claims 1,13, 25, and 39 have been discussed above, and as has 
been demonstrated, Patel does not anticipate these independent claims. Accordingly, Patel 
cannot be combined with Schneier (assuming, arguendo , that such combination could be made, 
and that one of skill in the art would be motivated to attempt it) to render dependent Claims 2, 6 - 
7, 9 - 12, 23, and 36 unpatentable. The Examiner is therefore respectfully requested to withdraw 
the §103 rejection. 
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V. Conclusion 

Applicant respectfully requests reconsideration of the pending rejected claims, 
withdrawal of all presently outstanding objections and rejections, and allowance of all remaining 
claims at an early date. 



Respectfully submitted, 




Attorney for Applicant 
Reg. No. 40,999 

Customer Number for Correspondence: 43 1 68 
Phone: 407-343-7586 
Fax: 407-343-7587 
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